fix(proxy): surface expired SSO sessions in OpenCode

[Filip-Stastny-Philips]

Summary

• Propagate blocking UserPromptSubmit hook failures so expired SSO sessions cannot silently submit another OpenCode request.
• Allow the auth gate's browser callback window to complete before the hook times out.
• Convert upstream SSO 401/403 and HTTP 200 HTML login pages into structured 401 JSON responses and mark the shared auth status invalid.

Root cause

The OpenCode shell hook discarded the parsed result from codemie hook, including exit status 2 from the auth gate. The proxy also streamed stale-session responses unchanged, allowing Keycloak HTML to reach the OpenCode SSE/JSON parser and produce empty 0-token turns with finish: \"unknown\".

Validation

• npx vitest run src/agents/plugins/codemie-code-hooks/__tests__/shell-hooks-source.test.ts src/agents/plugins/opencode/__tests__/opencode-session-lifecycle.test.ts src/providers/plugins/sso/proxy/plugins/__tests__/sso-auth.plugin.test.ts — 29 passed
• Related OpenCode/proxy tests — 275 passed
• npx tsc --noEmit — passed
• Focused ESLint — passed

The full unit suite currently reports three unrelated failures in existing AgentCLI-model-source and BaseAgentAdapter tests when run with this local environment's active profile/model settings.

Notes

• Branch is based on origin/main and pushed to the contributor fork.
• No production resources or unrelated working-tree changes are included.